[java-metadata-aggregator] branch master updated: MDA-214 - Add X509DSADetector
Ian Young
ian at iay.org.uk
Tue Dec 18 07:09:36 EST 2018
This is an automated email from the git hooks/post-receive script.
iay pushed a commit to branch master
in repository java-metadata-aggregator.
View the commit online:
http://git.shibboleth.net/view/?p=java-metadata-aggregator.git;a=commit;h=1231e0fe2309950217f440da23e14ac6502a334e
The following commit(s) were added to refs/heads/master by this push:
new 1231e0f MDA-214 - Add X509DSADetector
1231e0f is described below
commit 1231e0fe2309950217f440da23e14ac6502a334e
Author: Ian Young <ian at iay.org.uk>
AuthorDate: Tue Dec 18 12:09:27 2018 +0000
MDA-214 - Add X509DSADetector
---
.../metadata/validate/x509/X509DSADetector.java | 119 +++++++++++++++++++++
.../resources/net/shibboleth/metadata/beans.xml | 3 +
.../validate/x509/X509DSADetectorTest.java | 87 +++++++++++++++
.../validate/x509/X509DSADetector-dsa1.pem | 17 +++
.../metadata/validate/x509/X509DSADetector-rsa.pem | 33 ++++++
5 files changed, 259 insertions(+)
diff --git a/aggregator-pipeline/src/main/java/net/shibboleth/metadata/validate/x509/X509DSADetector.java b/aggregator-pipeline/src/main/java/net/shibboleth/metadata/validate/x509/X509DSADetector.java
new file mode 100644
index 0000000..1340326
--- /dev/null
+++ b/aggregator-pipeline/src/main/java/net/shibboleth/metadata/validate/x509/X509DSADetector.java
@@ -0,0 +1,119 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.metadata.validate.x509;
+
+import java.security.PublicKey;
+import java.security.cert.X509Certificate;
+
+import javax.annotation.Nonnull;
+import javax.annotation.concurrent.ThreadSafe;
+
+import net.shibboleth.metadata.Item;
+import net.shibboleth.metadata.validate.BaseValidator;
+import net.shibboleth.metadata.validate.Validator;
+import net.shibboleth.utilities.java.support.component.ComponentSupport;
+
+/**
+ * Validator class to check that X.509 certificates do not contain DSA public keys.
+ *
+ * <p>The original Digital Signature Algorithm (DSA) is very weak by modern standards,
+ * involving a 1024-bit key and the SHA-1 digest algorithm.</p>
+ *
+ * <p>By default, this validator adds an {@link net.shibboleth.metadata.ErrorStatus} to an
+ * item containing a certificate wrapping a DSA public key, and returns
+ * {@link net.shibboleth.metadata.validate.Validator.Action#DONE}
+ * on the basis that further processing of the certificate is unlikely to be desired.</p>
+ *
+ * <p>The {@link #error} property may be set to <code>false</code> to downgrade the
+ * {@link net.shibboleth.metadata.ErrorStatus} to a {@link net.shibboleth.metadata.WarningStatus}.</p>
+ *
+ * <p>The {@link #action} property may be set to
+ * {@link net.shibboleth.metadata.validate.Validator.Action#CONTINUE} if there is a need to
+ * perform additional validation on a DSA certificate.</p>
+ */
+ at ThreadSafe
+public class X509DSADetector extends BaseValidator implements Validator<X509Certificate> {
+
+ /**
+ * {@link net.shibboleth.metadata.validate.Validator.Action} to return when a DSA key is detected. Default:
+ * {@link net.shibboleth.metadata.validate.Validator.Action#DONE}.
+ */
+ private Action action = Action.DONE;
+
+ /**
+ * Whether an {@link net.shibboleth.metadata.ErrorStatus} should be added on failure.
+ *
+ * Default: <code>true</code>.
+ */
+ private boolean error = true;
+
+ /**
+ * Returns the {@link net.shibboleth.metadata.validate.Validator.Action} to be returned if a DSA key is detected.
+ *
+ * @return the {@link net.shibboleth.metadata.validate.Validator.Action} to be returned
+ */
+ public Action getAction() {
+ return action;
+ }
+
+ /**
+ * Sets the {@link net.shibboleth.metadata.validate.Validator.Action} to be returned if a DSA key is detected.
+ *
+ * @param newAction the {@link net.shibboleth.metadata.validate.Validator.Action} to be returned
+ */
+ public void setAction(@Nonnull final Action newAction) {
+ ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ action = newAction;
+ }
+
+ /**
+ * Set whether an {@link net.shibboleth.metadata.ErrorStatus} should be added on failure.
+ *
+ * @param newValue whether an {@link net.shibboleth.metadata.ErrorStatus} should be added on failure
+ */
+ public void setError(final boolean newValue) {
+ ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+
+ error = newValue;
+ }
+
+ /**
+ * Returns whether an {@link net.shibboleth.metadata.ErrorStatus} is being added on failure.
+ *
+ * @return <code>true</code> if an {@link net.shibboleth.metadata.ErrorStatus} is being added on failure.
+ */
+ public boolean isError() {
+ return error;
+ }
+
+ @Override
+ public Action validate(@Nonnull final X509Certificate cert, @Nonnull final Item<?> item,
+ @Nonnull final String stageId) {
+ final PublicKey key = cert.getPublicKey();
+ if ("DSA".equals(key.getAlgorithm())) {
+ addStatus(error, "certificate contains a DSA key", item, stageId);
+ return action;
+ } else {
+ return Action.CONTINUE;
+ }
+ }
+
+}
diff --git a/aggregator-pipeline/src/main/resources/net/shibboleth/metadata/beans.xml b/aggregator-pipeline/src/main/resources/net/shibboleth/metadata/beans.xml
index 378fa0e..766df94 100644
--- a/aggregator-pipeline/src/main/resources/net/shibboleth/metadata/beans.xml
+++ b/aggregator-pipeline/src/main/resources/net/shibboleth/metadata/beans.xml
@@ -291,6 +291,9 @@
net.shibboleth.metadata.validate.x509
-->
+ <bean id="mda.X509DSADetector" abstract="true" parent="mda.validator_parent"
+ class="net.shibboleth.metadata.validate.x509.X509DSADetector"/>
+
<bean id="mda.X509ROCAValidator" abstract="true" parent="mda.validator_parent"
class="net.shibboleth.metadata.validate.x509.X509ROCAValidator"/>
diff --git a/aggregator-pipeline/src/test/java/net/shibboleth/metadata/validate/x509/X509DSADetectorTest.java b/aggregator-pipeline/src/test/java/net/shibboleth/metadata/validate/x509/X509DSADetectorTest.java
new file mode 100644
index 0000000..2a8fc2d
--- /dev/null
+++ b/aggregator-pipeline/src/test/java/net/shibboleth/metadata/validate/x509/X509DSADetectorTest.java
@@ -0,0 +1,87 @@
+
+package net.shibboleth.metadata.validate.x509;
+
+import java.security.cert.X509Certificate;
+
+import org.testng.Assert;
+import org.testng.annotations.Test;
+
+import net.shibboleth.metadata.Item;
+import net.shibboleth.metadata.MockItem;
+import net.shibboleth.metadata.validate.Validator.Action;
+
+public class X509DSADetectorTest extends BaseX509ValidatorTest {
+
+ /**
+ * Constructor sets class under test.
+ *
+ * @throws Exception if something goes wrong
+ */
+ public X509DSADetectorTest() throws Exception {
+ super(X509DSADetector.class);
+ }
+
+ /*
+ * Test against an example DSA certificate with the default setting of the
+ * error property.
+ */
+ @Test
+ public void testDSA1error() throws Exception {
+ final Item<String> item = new MockItem("foo");
+ final X509DSADetector val = new X509DSADetector();
+ val.setId("DSA");
+ Assert.assertTrue(val.isError());
+ Assert.assertSame(val.getAction(), Action.DONE);
+ val.initialize();
+ final X509Certificate cert = getCertificate("dsa1.pem");
+ Assert.assertEquals(val.validate(cert, item, "stage"), Action.DONE);
+ errorsAndWarnings(item, 1, 0);
+ }
+
+ /*
+ * Test against an example DSA certificate with the action property set to
+ * CONTINUE.
+ */
+ @Test
+ public void testDSA1continue() throws Exception {
+ final Item<String> item = new MockItem("foo");
+ final X509DSADetector val = new X509DSADetector();
+ val.setId("DSA");
+ val.setAction(Action.CONTINUE);
+ val.initialize();
+ final X509Certificate cert = getCertificate("dsa1.pem");
+ Assert.assertEquals(val.validate(cert, item, "stage"), Action.CONTINUE);
+ errorsAndWarnings(item, 1, 0);
+ }
+
+ /*
+ * Test against an example DSA certificate with the error property set to
+ * false, so that a warning is used instead.
+ */
+ @Test
+ public void testDSA1warning() throws Exception {
+ final Item<String> item = new MockItem("foo");
+ final X509DSADetector val = new X509DSADetector();
+ val.setId("DSA");
+ val.setError(false);
+ val.initialize();
+ final X509Certificate cert = getCertificate("dsa1.pem");
+ Assert.assertEquals(val.validate(cert, item, "stage"), Action.DONE);
+ errorsAndWarnings(item, 0, 1);
+ }
+
+ /*
+ * Test against an RSA certificate; it should be ignored, with a CONTINUE action.
+ */
+ @Test
+ public void testRSA() throws Exception {
+ final Item<String> item = new MockItem("foo");
+ final X509DSADetector val = new X509DSADetector();
+ val.setId("DSA");
+ val.initialize();
+ final X509Certificate cert = getCertificate("rsa.pem");
+ Assert.assertEquals(val.validate(cert, item, "stage"), Action.CONTINUE);
+ errorsAndWarnings(item, 0, 0);
+ }
+
+}
diff --git a/aggregator-pipeline/src/test/resources/net/shibboleth/metadata/validate/x509/X509DSADetector-dsa1.pem b/aggregator-pipeline/src/test/resources/net/shibboleth/metadata/validate/x509/X509DSADetector-dsa1.pem
new file mode 100644
index 0000000..8a59590
--- /dev/null
+++ b/aggregator-pipeline/src/test/resources/net/shibboleth/metadata/validate/x509/X509DSADetector-dsa1.pem
@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE-----
+MIIDNDCCAvKgAwIBAgIEb5ObnTALBgcqhkjOOAQDBQAwbDEQMA4GA1UEBhMHVW5rbm93bjEQMA4G
+A1UECBMHVW5rbm93bjEQMA4GA1UEBxMHVW5rbm93bjEQMA4GA1UEChMHVW5rbm93bjEQMA4GA1UE
+CxMHVW5rbm93bjEQMA4GA1UEAxMHVW5rbm93bjAeFw0xODEyMDQxNTExNTRaFw0xOTAzMDQxNTEx
+NTRaMGwxEDAOBgNVBAYTB1Vua25vd24xEDAOBgNVBAgTB1Vua25vd24xEDAOBgNVBAcTB1Vua25v
+d24xEDAOBgNVBAoTB1Vua25vd24xEDAOBgNVBAsTB1Vua25vd24xEDAOBgNVBAMTB1Vua25vd24w
+ggG3MIIBLAYHKoZIzjgEATCCAR8CgYEA/X9TgR11EilS30qcLuzk5/YRt1I870QAwx4/gLZRJmlF
+XUAiUftZPY1Y+r/F9bow9subVWzXgTuAHTRv8mZgt2uZUKWkn5/oBHsQIsJPu6nX/rfGG/g7V+fG
+qKYVDwT7g/bTxR7DAjVUE1oWkTL2dfOuK2HXKu/yIgMZndFIAccCFQCXYFCPFSMLzLKSuYKi64QL
+8Fgc9QKBgQD34aCF1ps93su8q1w2uFe5eZSvu/o66oL5V0wLPQeCZ1FZV4661FlP5nEHEIGAtEkW
+cSPoTCgWE7fPCTKMyKbhPBZ6i1R8jSjgo64eK7OmdZFuo38L+iE1YvH7YnoBJDvMpPG+qFGQiaiD
+3+Fa5Z8GkotmXoB7VSVkAUw7/s9JKgOBhAACgYAfaISLJI8xzwOu9PabUJpJqFkcoH33U/cpeAYY
+ax3fREBoN+T4TJDKbnCmwMGB+7mDSpw58C4gl5hTtafKmRthUDRHi+V8mYWWhwG79iDgLX2vKj2r
+w9omni2viBN3SYR8pNNvAbq18Zzph670ROnK/MFuvSll6gMm2oAnE4STGKMhMB8wHQYDVR0OBBYE
+FPJot6yf7xoPBRxigH/pzRxul8neMAsGByqGSM44BAMFAAMvADAsAhQ2+gqWnY646SK53+TYMFWL
++gZvNgIUXjqkk2q1qKZfeShd4mmRT+veEmM=
+-----END CERTIFICATE-----
diff --git a/aggregator-pipeline/src/test/resources/net/shibboleth/metadata/validate/x509/X509DSADetector-rsa.pem b/aggregator-pipeline/src/test/resources/net/shibboleth/metadata/validate/x509/X509DSADetector-rsa.pem
new file mode 100644
index 0000000..bd66dc0
--- /dev/null
+++ b/aggregator-pipeline/src/test/resources/net/shibboleth/metadata/validate/x509/X509DSADetector-rsa.pem
@@ -0,0 +1,33 @@
+-----BEGIN CERTIFICATE-----
+MIIFnzCCA4egAwIBAgIJALg5LkKZhd8/MA0GCSqGSIb3DQEBCwUAMGYxCzAJBgNV
+BAYTAkdCMREwDwYDVQQIDAhTY290bGFuZDESMBAGA1UEBwwJRWRpbmJ1cmdoMRUw
+EwYDVQQKDAxJYW4gQS4gWW91bmcxGTAXBgNVBAMMEFRlc3QgQ2VydGlmaWNhdGUw
+HhcNMTgxMjE4MDcyMTI0WhcNMTkxMjE4MDcyMTI0WjBmMQswCQYDVQQGEwJHQjER
+MA8GA1UECAwIU2NvdGxhbmQxEjAQBgNVBAcMCUVkaW5idXJnaDEVMBMGA1UECgwM
+SWFuIEEuIFlvdW5nMRkwFwYDVQQDDBBUZXN0IENlcnRpZmljYXRlMIICIjANBgkq
+hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAox7U5S/tgnn5GaEbskkDIPIV4iMOIWRG
+7OP33JDh0UJXmM32k97sh0iJy4Norn6opUWRC3AbYJCDoiGP07VyYU1pxHgIlZqS
+1YXpIbCZsBam1ArAMdOEkPgzwl6KdbaCXQU8BgYnYMvYuR5LNv0VVvSpkY6Vfi7k
+edevAHuK85CYzKM6UAgSfyMSSg5PeNmDq7VAlvgcBthWsMIkN9hIGlHySxhItb0R
+s+RdCZLUbNWvAyQ5OtTLbdOzmRlHYxkJMde1+DUtgx7ytQLUX27H8/mR0tq/TXAX
+d9wV32Ounhukc1F0T4gdzT37afBT7qYGLENp7QmR2j+EhRIfvhGpIyGqu9VlnWlM
+bmvDLd4uS1EB0fW9MvyydBlakoH9xYzdnBOLMB2Y26zugumqOGRg7zUR+UypfGDO
+OgH6VTQE/rC6rPrS3W3WNnx/L8rA3wH2G5Zw3QEtwtq/c+o4ZP26gvwqH+P8h7Va
+Fla92YLOp9eGvFHpOvd/qmMbx/FYyFvMIpnvUMDJF3iynT90h1919epewKkOicjq
+gWF9k5NM5jDX7xcJMoJwAkr3hyjM1QpdfX1S42I+tx4L0pTl+xYSTLKxrRCIGaEg
+JDIhNhBggjtO49KICccnd/VjnH9V36sUKQsLyJsl4Z0gotmkHRFiL5klQxi98+E3
+12W99buv/zcCAwEAAaNQME4wHQYDVR0OBBYEFMQV803dVajkF5P+QNVkTtIMgjlA
+MB8GA1UdIwQYMBaAFMQV803dVajkF5P+QNVkTtIMgjlAMAwGA1UdEwQFMAMBAf8w
+DQYJKoZIhvcNAQELBQADggIBADUqhGaMorSzaV1LQhr9xz38iFczMZxnLvEbuU3+
+HoTSJ9NTwpIZC+HVqi07NoUzHWeviTGwC5OaRipJULBtfV1v0K1chE8IgpYxYh7B
+r+cxwo6O75wgmcE4UVBOKHhqAkEU/hTpgV5OHgiYf4n3N+ei2u8I1t4oqFF2OFbF
+uxBDh2bthwkPefXCCXpWUHQpqWvC3z1VH8b8lQVQD9b1AwrUNhylrBgUvctl6fBv
+DLp/h8EUNw/e+NfqvFKWt8ieBjUR0oZb8t1HG6vi5c7yY/d8Qc4/nNiWkx2ECCpE
+skL/zhwqeOi+Ag0fXryryHfLD8MAz/TmuiLETf2cjGkK7kEC35OXeHDuEPoVsIc2
+FGYgbjUdFR8toUxNahQDE4MeYFNU0CtgKHNNTRgayS/RXypEQ+HUu0qC2vTFZKvm
+V5PFVqwTOAF/yC/xf1xtUQ+/9r9OIvUCpdeFz7kTbotldnAEPKImU8S/9Pgfxxp8
+7gAoBOR9BJ6jlGgmjlfc7RswXHW1s14oUCheBKGVEinNMANqXK+yPtkjhOQIXE7k
+ljYAmWcXtVLCKePMElCqiXUlLdjaZ9ZXJ2c7/a8sqp7Ar6/18fXpS7NRwrjgSMUP
+ssDK2rAQRTPfmLyCdUOvjvE6uN/Q9WdLpDssJN4pohRiQhfvOmEhhcrIUOxBWJ/z
+RSLn
+-----END CERTIFICATE-----
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list